Ransomware Hits Absolute Machine Tools by Play Group
Ransomware Attack on Absolute Machine Tools by Play Group
Absolute Machine Tools, a leading importer and distributor of CNC machine tools in North America, has become the latest victim of a ransomware attack by the notorious Play ransomware group. The attack, discovered on October 19, 2024, has compromised a significant amount of sensitive data, posing substantial risks to the company's operations and client confidentiality.
Company Profile and Industry Standing
Founded in 1988, Absolute Machine Tools has established itself as a key player in the manufacturing sector, specializing in advanced metalworking solutions. The company is known for its extensive inventory of CNC machines, including brands like Johnford, You Ji, Enshu, and Fanuc. With a strong emphasis on customer satisfaction, Absolute Machine Tools offers exceptional post-sale service and engineering support. The company operates with an Employee Stock Ownership Plan (ESOP), fostering a culture of ownership and accountability among its employees.
Details of the Ransomware Attack
The Play ransomware group, active since June 2022, has claimed responsibility for the attack on Absolute Machine Tools. The breach has led to the exposure of a wide array of sensitive data, including client documents, payroll records, and financial information. The full extent of the data leak remains undetermined, highlighting the severe impact on the company's operations and its clients' confidentiality.
Play Ransomware Group's Modus Operandi
The Play ransomware group, also known as PlayCrypt, has been involved in numerous high-profile attacks across various industries. The group is known for exploiting vulnerabilities in RDP servers, FortiOS, and Microsoft Exchange to gain initial access to networks. They employ tools like Mimikatz for privilege escalation and use custom tools to disable antimalware solutions. Unlike typical ransomware groups, Play does not include an initial ransom demand in their notes, directing victims to contact them via email instead.
Potential Vulnerabilities and Attack Penetration
Absolute Machine Tools' extensive digital infrastructure and reliance on sensitive data make it a prime target for ransomware attacks. The Play group likely exploited vulnerabilities in the company's network, potentially through compromised VPN accounts or unpatched software vulnerabilities. The attack underscores the critical need for enhanced cybersecurity measures in the manufacturing sector, particularly for companies handling sensitive client data.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!